Vulnerability in Kernel package: Input: stmfts - do not leave device disabled in stmfts_input_open
Summary
GSD-2022-1003562: Input: stmfts - do not leave device disabled in stmfts_input_open. Affects Kernel versions >= 5565fc538ded8961c9d885ad37200ee72a7bd1a2, < baf86afed74548adf3e8623ce8592edc8caa5cd3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and acts as a bridge between the hardware and software layers. The stmfts module within the Kernel package is responsible for managing input devices. It allows users to interact with the system through various input devices such as keyboards, mice, and touchscreens. However, a vulnerability has been discovered in the stmfts_input_open function, which can leave the device disabled. This vulnerability can potentially be exploited by attackers to disrupt the normal functioning of input devices, leading to a denial-of-service condition or other security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the stmfts_input_open function of the Kernel's stmfts module. When a device is opened, the function fails to properly enable the device, leaving it in a disabled state. This can occur due to an incorrect handling of device initialization or an error condition. An attacker can exploit this vulnerability by repeatedly opening and closing the device, causing it to remain disabled and rendering it unusable. The impact of this vulnerability can range from inconvenience to users who rely on the affected input device to potential security risks if the disabled device is part of a critical system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can try manually enabling the disabled device after opening it. This can be achieved by using the appropriate system commands or APIs to enable the device. However, this workaround may not be feasible or practical for all users, especially in cases where the disabled device is critical for system operation. It is strongly advised to apply the official fix provided in the updated Kernel package.
Conclusion
In conclusion, a vulnerability has been discovered in the Kernel package's stmfts module, specifically in the stmfts_input_open function. This vulnerability can leave the device disabled, potentially leading to a denial-of-service condition or other security issues. The issue has been addressed in the Linux Kernel version v5.10.121, and users are advised to update their Kernel package to this version or any subsequent version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact can range from inconvenience to users who rely on the affected input device to potential security risks if the disabled device is part of a critical system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, a temporary workaround is to manually enable the disabled device after opening it. However, it is strongly recommended to apply the official fix provided in the updated Kernel package.
The updated Kernel package, containing the fix for this vulnerability, can be obtained from the official Linux Kernel repository.
At the time of this report, no known exploits for this vulnerability have been identified. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
